Kaseya cyberattackers demand $70m as attack brings down clients and users

A major cyberattack on US IT firm Kaseya has rippled through its global managed service provider clients and their customers, with the ransom demand to restore systems reported to be sitting at $70m. The attack has brought down systems globally, with the number of affected companies still to be determined but some reports suggesting at least one million systems are caught up in the attack. Posts on the dark web indicate that cybercrime gang REvil, which pocketed $11m in ransom last month from an attack on Brazilian meatpacking firm JBS, is behind the Kaseya attack. The gang, which has links to Russia, has said a payment of $70m in bitcoin will unlock all the affected systems. After gaining access to Kaseya, the attackers exploited vulnerabilities in its virtual system/server administrator (VSA) software. This is used by its clients – including schools, businesses, public sector bodies and many small businesses – to manage infrastructure through a hosted cloud or on-premises VSA server. Providing regular updates since the attack was exposed, Kaseya said the “sophisticated cyberattack” on its VSA software is “localised to a very small number of on-premises customers only”. It asked VSA clients to take their systems offline but the attack has rippled through to VSA software clients. “We are confident we understand the scope of the issue and are partnering with each client to do everything possible to remediate. We believe that there is zero related risk right now for any VSA client who is a SaaS customer or on-premises VSA customer who has their server offline,” Kaseya said yesterday. The Swedish Coop supermarket chain was forced to close hundreds of stores at the weekend after the attack brought down its cash registers. In New Zealand, education ministers said 11 schools had reported their systems had been affected by the Kaseya attack and would be shut down for 48 hours. The US government said the FBI is investigating the cyberattack and US companies have been asked to report to the Internet Crime Complaint Center if their systems have been compromised in the attack. US President Joe Biden, who raised the issue of cybercrime in a meeting with Russia’s Vladimir Putin last month, said he wants a “deep dive” on who is behind the attack. “If it is either with the knowledge of and/or the consequence of Russia, then I told Putin we will respond,” President Biden said. According to a Twitter post from the Dutch Institute for Vulnerability Disclosure (DIVD), Kaseya was already working on a patch to fix the vulnerabilities when the ransomware attack struck. DIVD said Kaseya had put in “maximum” effort” to address issues in its software. “They showed a genuine commitment to do the right thing. Unfortunately, we were beaten by REvil in the final sprint, as they could exploit the vulnerabilities before customers could even patch,” the DIVD said in a blog. Yesterday, the DIVD said the number of Kaseya VSA servers still connected to the internet has fallen from 2,200 to 140. Speaking on BBC Radio 4, the first CEO of the UK’s National Cyber Security Centre, Ciaran Martin, said the “scale and sophistication of this global crime is rare, if not unprecedented”.

Kaseya cyberattackers demand $70m as attack brings down clients and users

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles